Subject: RE: [Asrg] Its all over for Challenge Response

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Fri, 30 Jan 2004 20:02:55 -0800

> Does anyone have any idea how much it costs to host a porn site?  Does
> anyone have any idea how little it costs to send spam (see prior
> analysis $0.0000002/spam)?
> 
> Just because it's possible doesn't mean it's sensible

If you are hosting the porn site on owned machines it costs you nothing.
Several of the spam scams are already doing this, they hack your machine and
run a porno server on it.

The problem with slashdot is that once a theoretical attack is described
there it almost always gets into the wild if it is at all possible. Hackers
exchange owned machines as a form of currency, they sell them to spammers
and they will no doubt sell spamers yahoo accounts if they can sign up in
bulk.

The fact it is bizare makes it more, not less likely.

		Phill

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Eric Dean" <[email-masked]>
Date: Sat, 31 Jan 2004 09:10:21 -0500

Certainly it's hard to build a fool-proof model when people are willing
to commit felonies.  In that case, sure, this is easy to do.  But if you
are a typical spammer, and base your model on hacking machines..you
might want to re-think.

If you are going to host free-porn to attract users to crack the Turing
tests...you will have a major hosting bill at the end of the month.
 
> If you are hosting the porn site on owned machines it costs 
> you nothing. Several of the spam scams are already doing 
> this, they hack your machine and run a porno server on it.

---

From: Paul Tenny <[email-masked]>
Date: Sat, 31 Jan 2004 21:17:27 -0500

It becomes exceptionally difficult when you rely on the law as part
of the solution to a problem. Your doors have locks even though it's 
illegal to break in, not because the lock compliments the law but 
because the law only means something to people who aren't criminals in 
the first place.

I think our legal system has shown over and over it doesn't matter how 
much you punish or threaten someone, the only way to stop them is to 
put up a better defense against *them*, not their methods.

---

From: "Alan DeKok" <[email-masked]>
Date: Sat, 31 Jan 2004 22:22:13 -0500

> because the law only means something to people who aren't criminals in 

  You've got it 100% backwards.  Everyone knows (or should know) that
locks won't keep all criminals out.  So the locks obviously aren't
there to keep the criminals out.

  The locks are there as a public statement by you that people have no
legal right to enter your home.  When someone does, they get charged
with "break and enter", which is a serious crime.  If you did not have
a lock, or left your door open, they would have been charged with
"trespass", which is a lesser crime.  (obligatory IANAL)

  So the conclusion is that locks are a legal statement which permit
the justice system to file more serious charges than they could have
without the locks.  In the same way, technological methods of fighting
spam should be not only used to stop the amateur spammer, they can be
used to leverage more serious charges against the professional
spammer.

  Despite the recent phenomenal increase in spam, there is still
massive opposition to *doing* anything about the problem.  I remain,
as always, amazed.

  Alan DeKok.